Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 01:13
Static task
static1
Behavioral task
behavioral1
Sample
e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exe
Resource
win10v2004-20240508-en
General
-
Target
e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exe
-
Size
192KB
-
MD5
d8d7d0d2989bab460e83b1222ea4488c
-
SHA1
9a89abcbbcbe9b80c35185d22a4afddc439f5281
-
SHA256
e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090
-
SHA512
7a28d4996ef9270322d0231147eba9eddca60c7b7eabb0485c14ded5ae689fb4be6aa001dc3ee1644c21ce8364d7b13785346113f4e5f246864e30346f00d1ba
-
SSDEEP
3072:l8B9tMfP9ZGFwgvRLLCzOYFDq+UdnIPPlMzcsofIw+KaX0LcHLkMIIR+:l6M96wgvRHCzOYtqlGyzcsX3KA0LQIQE
Malware Config
Signatures
-
Gh0st RAT payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/216-5-0x0000000010000000-0x0000000010121000-memory.dmp family_gh0strat behavioral2/memory/216-7-0x0000000010000000-0x0000000010121000-memory.dmp family_gh0strat behavioral2/memory/216-3-0x0000000010000000-0x0000000010121000-memory.dmp family_gh0strat behavioral2/memory/216-2-0x0000000010000000-0x0000000010121000-memory.dmp family_gh0strat behavioral2/memory/216-10-0x0000000010000000-0x0000000010121000-memory.dmp family_gh0strat behavioral2/memory/216-13-0x0000000010000000-0x0000000010121000-memory.dmp family_gh0strat -
Detects executables embedding registry key / value combination manipulating RDP / Terminal Services 6 IoCs
Processes:
resource yara_rule behavioral2/memory/216-5-0x0000000010000000-0x0000000010121000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP behavioral2/memory/216-7-0x0000000010000000-0x0000000010121000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP behavioral2/memory/216-3-0x0000000010000000-0x0000000010121000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP behavioral2/memory/216-2-0x0000000010000000-0x0000000010121000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP behavioral2/memory/216-10-0x0000000010000000-0x0000000010121000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP behavioral2/memory/216-13-0x0000000010000000-0x0000000010121000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XXXXXX34808828 = "C:\\Windows\\XXXXXX34808828\\svchsot.exe" e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exe -
Drops file in System32 directory 3 IoCs
Processes:
e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Default e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exe File created C:\Windows\SysWOW64\34808828 e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exe File opened for modification C:\Windows\SysWOW64\34808828 e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exepid process 216 e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exe 216 e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exe 216 e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exe 216 e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exe 216 e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exe 216 e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exepid process 216 e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exe"C:\Users\Admin\AppData\Local\Temp\e0dfa63bfc9f333897ca3d3fde1f473aba1f42d68ca36afc0824a88c5e020090.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/216-5-0x0000000010000000-0x0000000010121000-memory.dmpFilesize
1.1MB
-
memory/216-7-0x0000000010000000-0x0000000010121000-memory.dmpFilesize
1.1MB
-
memory/216-9-0x0000000000800000-0x0000000000840000-memory.dmpFilesize
256KB
-
memory/216-3-0x0000000010000000-0x0000000010121000-memory.dmpFilesize
1.1MB
-
memory/216-2-0x0000000010000000-0x0000000010121000-memory.dmpFilesize
1.1MB
-
memory/216-0-0x0000000010000000-0x0000000010121000-memory.dmpFilesize
1.1MB
-
memory/216-10-0x0000000010000000-0x0000000010121000-memory.dmpFilesize
1.1MB
-
memory/216-13-0x0000000010000000-0x0000000010121000-memory.dmpFilesize
1.1MB
-
memory/216-14-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/216-16-0x0000000000800000-0x0000000000840000-memory.dmpFilesize
256KB